GitHub integration permissions

[Michael Juarez]

Greetings,

We are looking at connecting the GitHub integration with Compass. We noticed that it wants the following permissions:

* Read access to actions, metadata, and organization events
* Read and write access to code, deployments, organization hooks, pull requests, and repository hooks.

Our SecEng team is looking for a better breakdown of what the possible write actions could be so they could correlate within audit logs.

[Dave Parrish _Atlassian_]

Hi @Michael Juarez 👋  It's Dave from the Compass product team. The GitHub integration needs write permission in order to create organization webhooks. This is the only write operation that the integration currently performs.

Webhooks are used for listening to several types of events-

• Push events - for handling changes to compass.yml metadata
• Pull request events - for calculating PR-related metrics
• Deployment events - for handling deploy events

Hope this is helpful! Please let me know if you have any further questions.

[Staffan Redelius]

Hi @Dave Parrish _Atlassian_ 

I am evaluating Compass for a customer and we got stuck on the needed privileges in GithHub for setting up the integration. 

Is there any way to limit the privileges? As I understand it this gives Compass the highest level of access in GitHub. As for now security sees a risk that the integration might be compromised and in case of a security breach this could be used to get access to GitHub and other resources connected to it.

Please advice if there is some other way to create the integration with a more limited scope or if there is any additional information I can pass on to the security dep. to ease their mind.

[Dmitry Pashkevich]

Why create organization webhooks when you can do it on a per-repo level? The latter would not require org admin permissions, which sounds scary and also comes with internal gatekeeping within the organization.